BUSINESS INTEGRITY PROGRAM
Policy Manual
APPROVED: May 14, 1998
by BOARD OF DIRECTORS
WASHINGTON COUNTY HEALTH SYSTEM
formerly titled “Legal Compliance Program”
Revised 5/2001
13. Confidentiality
Health care professionals and staff usually know sensitive, private facts about patients
and their care. Patients have a right to expect that this information will remain
confidential. The system takes very seriously any violation of patient confidentiality.
Employees may not discuss a patient's medical condition or provide information about
patients to anyone except health system staff or other authorized persons needing the
information. Violating this rule will have serious consequences for an employee.
Employees should not discuss patients outside their health system duties or with their
families.
The health system owns the patient’s medical record. This record details a patient's
condition and the services received by the patient. Medical records are strictly
confidential. They may not be released without the patient’s consent or in other limited
circumstances. Special protection applies to mental health records, records of substance
abuse treatment, and records relating to HIV status. Medical records may not be
physically removed from the health system, changed, or destroyed. Employees who have
access to medical records must take great care to preserve their confidentiality and
integrity. No employee may access the medical record of any patient without a
legitimate, health system-related reason. Any unauthorized release of or access to
medical records should be reported to a supervisor.
Many facts about patients are stored in the health system’s computer records. There are
laws designed to punish and discourage computer crime. The health system prohibits
unauthorized access to its computer systems, either directly or by network or phone.
Anyone without a valid password into the system is not authorized to use the computer
systems. Attempts by unauthorized users to access the system will be treated as
confidentiality violations. The health system prohibits destroying or corrupting
computerized data. Persons who violate these rules will be prosecuted to the full extent
of the law.
State laws may also apply. If so, the health system will comply with the letter, spirit, and
intent of each law. Personnel policies III-13 (Mandatory Inservices and V-50
(Confidentiality) also apply.